While a responsible ISP or domain admin should take quick action to notify and/or temporarily disconnect the offending party, keeping a cool head can only help the situation progress smoothly and swiftly to the satisfaction of all parties involved.
There are several services on the web that facilitate IP lookups. If valid, the IP address will return the full DNS record for whoever is legally and technically responsible for managing that account, including the name, email address, and telephone number for the primary technical contact at that company. Caveat emptor - forging and bogus information is common.
Popular lookup services (also known as WHOIS) include APNIC, ARIN, and Network Solutions.
If you're sure you've found the proper contact info, phone or email the technical contact and explain the situation. To take action, they will likely request a copy of the email header(s) involved and may ask that you copy and paste them into an email to send them. If further help is needed in understanding email spoofing, reading email headers, or locating the proper DNS information, post a message to the antivirus forum .
